Dashboards & Visualizations

Drill Down Help for Dashboard with \ in variable

ghostdog920
Path Finder

Good morning,

I am trying to build a drill down off one dashboard panel to build a search in the second. The issue i am running into is am passing a value of pf\first.last but in the new search, it needs to pass as pf\first.last (notice the extra escape \ character). Does anyone know how i might do this? My current search is: (where $user.user$) is a drill down set value option from a corresponding panel.

eventtype="pan_url" dest_zone="L3-Untrust" src_user=$user.user$ (app=adobe-connect OR app=brighttalk OR app=citrix OR app=citrix-jedi OR app=clearspace OR app=globalmeet-base OR app=gotomeeting OR app=gotowebinar-base OR app=hp-virtual-rooms OR app=jabber OR app=join-me OR app=live-meeting OR app=meetup OR app=skype OR app=tigertext OR app=webex OR app=zendesk OR app=zoom OR app=teamviewer-base)| stats count by app | sort - count

Any help is greatly apprecated.

Tags (1)
0 Karma
1 Solution

ghostdog920
Path Finder

Thank you for that. I am trying to use the edit drill down so not sure how I would implement that in the first panel to feed to the second. Here is a screenshot in case it proves helpful.

alt text

View solution in original post

0 Karma

ghostdog920
Path Finder

Got It! Thank you. Worked like a champ!

0 Karma

ghostdog920
Path Finder

Thank you for that. I am trying to use the edit drill down so not sure how I would implement that in the first panel to feed to the second. Here is a screenshot in case it proves helpful.

alt text

0 Karma

elliotproebstel
Champion

In the first panel, you are taking the value from one field, adding a second slash to the value in that field, and putting it into the token user.name. Let's say the field in the first panel is called name_field. Then in the dropdown you show above, you'd change "Set" to "Eval", leave "user.user" in the first text entry box, and put this into the second:

mvjoin(split($row.name_field$, "\\"), "\\\\")

That should take the value from name_field in the first panel, add a second slash, and put it all into the user.user token.

0 Karma

elliotproebstel
Champion

How about using an eval to add a second slash before passing it to the other dashboard? Here's a sample:

| makeresults 
| eval a="pf\something" 
| eval b=mvjoin(split(a, "\\"), "\\\\")

This guide documents how to use <eval> elements to modify values being passed in a drilldown:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...